Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters?

User subnet 192.168.20.0/24, default route 192.168.20.1 HoneyD subnet 192.168.25.0/24. The IP used to reach here is 192.168.20.254.

The router has a static route entry for 192.168.25.0/24 via 192.168.20.254.

Everything works as I would expect except for getting all the traffic bound for 192.168.20.255 in my logs.

This is mostly from NETBIOS traffic but it happens elsewhere as well.

Note - I did review Honeyd: log grows too fast. Still seems there should be a way to address this without needing to restructure my network. I really do want the gateway to be sitting in a subnet that will be picking up real traffic.

share|improve this question
    
Filter packets at firewall? –  schroeder Jan 28 at 17:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.